INFORMATION ON THE PROCESSING OF PERSONAL DATA
PURSUANT TO ART. 13-14 REG. EU No. 679/2016
Interested parties: employees of customers and supplier companies
BrainSoftware S.r.l. - during the execution of a contract with its customers and suppliers, or in the execution of controls, verifications or audits, or in the phase of commercial relations - may become aware of personal data concerning the employees of client companies, suppliers or prospect (hereinafter "data subjects"). Pursuant to current legislation, BrainSoftware S.r.l. therefore issues to data subjects the subsequent information, pursuant to art. 13 and 14 EU Reg. No. 679/2016 and to the Privacy Code, as amended by Legislative Decree nr. 101/2018.
Identity and contact details of the data controller
Purposes of the processing of personal data
The processing of personal data by BrainSoftware S.r.l. is aimed at executing the contract concluded with the employer of data subjects or at the execution of verification, control and audit activities before or after the execution of the contract, as well as the execution of the existing commercial relationship.
Legal basis of the processing
The processing of personal data is necessary for the purposes of the legitimate interests pursued by the undersigned company and precisely to execute the contract concluded between BrainSoftware S.r.l. and the organization of which the worker is part or in the context of the negotiations for the conclusion of the contract, or, furthermore, during audits, controls or audits.
Categories of processed data
Common personal data is processed (relating to the employment relationship, job duties, personal and fiscal data, contact details, etc.), to the extent that processing is strictly necessary for the purposes indicated.
Any recipients or categories of recipients of personal data
Personal data may be known by BrainSoftware S.r.l. employees specifically authorized to process data or to third parties duly appointed Data Processors, to the extent that such knowledge is necessary for the purposes indicated.
Data transfer to third countries
BrainSoftware S.r.l. does not intend, at present, to transfer your personal data to countries outside the European Union.
In any case, if this happens, BrainSoftware S.r.l. guarantees that the transfer will be to countries outside the EU that the European Commission has deemed to guarantee an adequate level of protection (art. 45 GDPR) or after the stipulation of standard contractual clauses approved by the European Commission.
Any exceptions to the above may take place only in compliance with the art. 49 GDPR.
Period of storage of personal data
The personal data will be kept by the undersigned organization for the entire duration of the contract with the organization which has the employment relationship with the data subject and for ten years after the termination of the effectiveness of the contract and/or in any case in compliance with the requirements of the current legislation on civil, fiscal and administrative data storage. A longer period of storage of personal data may possibly be determined by requests made by the Public Administration or by another judicial, governmental or regulatory body or by the participation of the undersigned company in judicial procedures that involve the processing of personal data.
The personal data processed by BrainSoftware S.r.l. in the phase prior to the conclusion of a contract with the employer of the data subject will be kept for the time strictly necessary for the negotiations and the formation of the contract and the pursuit of verification, control and audit activities.
Rights of the interested party
Data subjects are entitled to obtain from the controller the access to their personal data, free of charge and without any damage to the rights and freedom of third parties. In particular, they have the right to obtain confirmation as to whether or not personal data concerning him or her are being processed, and the following information: a) the origin of personal data, if the data has not been collected from the data subject; b) the categories of personal data; c) the purposes and methods of processing; d) the existence of an automated process, including profiling, and, in this case, the logic applied, as well as the importance and expected consequences of such processing for the data subject; e) updating or rectification; f) the deletion or limitation of the processing of data concerning him or her (transformation into anonymous form, blocking of data processed in violation of the law, including those for which conservation is not necessary in relation to the purposes for which the data were collected or subsequently treated); g) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if they are recipients of international organizations or third countries (in the latter case, the interested party has the right to be informed of the existence of adequate guarantees pursuant to article 46 relating to the transfer); h) when possible, the period for which retention of personal data is required or, if this is not possible, the criteria used to determine this period.
Data subjects have the right to withdraw the consent to the processing of personal data and to oppose the processing. In any case, the withdrawal of the consent to the processing does not affect the lawfulness of the treatment based on the consent given before the revocation.
Data subjects are also entitled to data portability.
Right to lodge a complaint with a supervisory authority
Data subjects have the right to lodge a complaint with the Supervisory Authority, represented in Italy by the "Garante per la Protezione dei Dati Personali", based in Rome, Piazza Monte Citorio, 121. The complaint may be presented in the most appropriate ways: by hand, by registered post, by fax or by mail. For any information, interested parties are invited to consult the website of the Guarantor at www.garanteprivacy.it.
Source from which personal data originate
Personal data was provided by the organization to which the data subject belongs, or directly from the data subject.
Non-existence of an automated decision-making process
The undersigned organization does not use automated decision-making processes that produce relevant legal effects for the data subject.